StrongDM Lab in a Box for GCP

Warning

While we will attempt to keep tagged versions "working", there are a lot of improvements being shipped. Update with caution :)

Overview

This repository contains a set of modules that enable the user to deploy a quick lab environment to evaluate StrongDM capabilities on Google Cloud Platform. The infrastructure is fully automated using Terraform and can be deployed in your GCP project in minutes.

Included Resources

• Network Infrastructure: VPC, subnets, firewall rules, Cloud NAT, and Cloud Router
• StrongDM Infrastructure: Gateway and relay with GCP Secret Manager integration
• Database Targets:
  • Cloud SQL PostgreSQL with credentials in Secret Manager
  • Firestore database (NoSQL document database)
• Linux Resources: SSH target using StrongDM's CA for authentication
• Kubernetes: GKE Cluster for container workloads
• Cloud Storage Access:
  • Read-only access to GCS
  • Full read/write access to GCS
• GCP Access: Read-only access to GCP resources via gcloud CLI
• Data Processing: Dataflow and Dataproc access for data engineering workloads
• HashiCorp Vault: Development instance for secrets management demonstration

All resources are properly labeled according to variables set in the module, ensuring consistent resource management and appropriate access roles in StrongDM.

Architecture

The lab environment creates a secure network architecture with:

• Public subnet for internet-facing components (StrongDM gateway)
• Private subnet for protected resources (databases, servers, relay)
• Cloud NAT for outbound internet access from private subnet
• Firewall rules configured for least-privilege access
• Proper routing between public and private resources

Prerequisites

GCP Setup

1. A GCP project with billing enabled

2. The following APIs enabled:

   • Compute Engine API
   • Cloud SQL Admin API
   • Secret Manager API
   • Kubernetes Engine API (if using GKE)
   • Firestore API (if using Firestore)
   • Dataflow API (if using Dataflow)
   • Dataproc API (if using Dataproc)

3. A service account or user with sufficient permissions to create resources

StrongDM Setup

In addition to the usual access credentials for GCP, the modules require an access key to StrongDM with the following privileges:

sdm admin tokens add TerraformSecMgmt --permissions secretstore:list,secretstore:create,secretstore:update,secretstore:delete,organization:view_settings,relay:list,relay:create,policy:read,policy:write,datasource:list,datasource:create,datasource:update,datasource:delete,datasource:healthcheck,resourcelock:delete,resourcelock:list,accessrequest:requester,secretengine:create,secretengine:list,secretengine:delete,secretengine:update,managedsecret:list,managedsecret:update,managedsecret:create,managedsecret:read,managedsecret:delete --duration 648000 --type api

Export the environment variables:

export SDM_API_ACCESS_KEY=auth-aaabbbbcccccc
export SDM_API_SECRET_KEY=jksafhlksdhfsahgghdslkhaslghasdlkghlasdkhglkshg

Note

If your control plane is in the UK, or the EU, make sure that the SDM_API_HOST variable is correctly set. Gateways and relays will use this variable as well to register against the right tenant

export SDM_API_HOST=api.uk.strongdm.com:443

Make sure you're logged into sdm with:

sdm login

Configuration Variables

GCP Configuration

• project_id: GCP Project ID where resources will be created (required)
• region: GCP region where resources will be created (default: us-central1)
• zone: GCP zone for zonal resources (default: us-central1-a)

Network Configuration

• network: Use an existing VPC network. If null, a new network will be created
• gateway_subnet: Use an existing public subnet. If null, a new subnet will be created
• relay_subnet: Use an existing private subnet. If null, a new subnet will be created

Resource Flags

• create_linux_target: Create a Linux target with SSH CA authentication
• create_postgresql: Create a Cloud SQL PostgreSQL database
• create_gke: Create a GKE (Kubernetes) cluster
• create_firestore: Create a Firestore database
• create_gcp_ro: Create a service account with read-only GCP access
• create_gcs_ro: Create a service account with read-only Cloud Storage access
• create_gcs_full: Create a service account with full Cloud Storage access
• create_dataflow: Create a service account with Dataflow/Dataproc access
• create_hcvault: Create a HashiCorp Vault development instance
• create_managedsecrets: Onboard domain users into StrongDM for credential management

Machine Types

• machine_types: Object specifying machine types for different components
  • gateway: Machine type for gateway (default: e2-micro)
  • relay: Machine type for relay (default: e2-micro)
  • linux_target: Machine type for Linux target (default: e2-micro)
  • vault: Machine type for Vault server (default: e2-micro)

Database Configuration

• postgresql_tier: Cloud SQL PostgreSQL tier (default: db-f1-micro)
• gke_node_machine_type: Machine type for GKE nodes (default: e2-standard-2)

General Configuration

• name: An arbitrary string that will be added to all resource names (required)
• tagset: Tags to apply to all StrongDM resources (required)
• labels: Labels to apply to all GCP resources

You can reference the terraform.tfvars.example file in the main module for example configurations.

Getting Started

1. Clone this repository

2. Navigate to the main module:

   cd gcp-lab-in-a-box/main

3. Copy and customize the example variables file:

   cp terraform.tfvars.example terraform.tfvars

4. Edit terraform.tfvars with your configuration

5. Initialize and apply Terraform:

   terraform init
   terraform plan
   terraform apply

Module Structure

gcp-lab-in-a-box/
├── main/                  # Main Terraform module
│   ├── terraform.tf       # Provider configuration
│   ├── variables.tf       # Variable definitions
│   ├── network.tf         # Network configuration
│   ├── gateway.tf         # StrongDM gateway
│   ├── relay.tf           # StrongDM relay
│   ├── secretmanager.tf   # Secret Manager configuration
│   └── *-target.tf        # Various target configurations
├── network/               # VPC and networking module
├── linux-target/          # Linux SSH target module
├── postgresql/            # Cloud SQL PostgreSQL module
├── gke/                   # GKE Kubernetes module
├── gcsro/                 # GCS read-only access module
├── gcsfull/               # GCS full access module
├── gcpro/                 # GCP read-only access module
├── dataflow/              # Dataflow/Dataproc module
├── firestore/             # Firestore database module
└── hcvault/               # HashiCorp Vault module

Feature Comparison

Feature	AWS	Azure	GCP
Gateway & Relay	Yes	Yes	Yes
Linux Target (SSH CA)	Yes	Yes	Yes
PostgreSQL	RDS	Azure PostgreSQL	Cloud SQL
Kubernetes	EKS	AKS	GKE
Object Storage RO	S3	Blob Storage	GCS
Object Storage Full	S3	Blob Storage	GCS
Cloud Read-Only	AWS	Azure	GCP
Data Processing	Glue	Data Factory	Dataflow/Dataproc
Document DB	DocumentDB	Cosmos DB	Firestore
HashiCorp Vault	Yes	Yes	Yes
Windows DC	Yes	Yes	Planned
Windows Target	Yes	Yes	Planned

Training Scenarios

This lab environment supports various training scenarios:

1. Database Access Management: Configure secure access to PostgreSQL and Firestore databases
2. Server Access Control: Manage Linux server access with SSH CA authentication
3. Kubernetes Integration: Demonstrate GKE cluster access management
4. Cloud Permissions: Show controlled GCP resource access through StrongDM
5. Storage Access: Demonstrate read-only and full access patterns for Cloud Storage
6. Data Engineering: Show access to Dataflow and Dataproc for data processing workloads

Troubleshooting

Common issues and their solutions:

1. API Not Enabled: Ensure all required GCP APIs are enabled for your project
2. Insufficient Permissions: Verify the service account has necessary IAM roles
3. Connection Failures: Check firewall rules allow traffic on required ports
4. Authentication Issues: Verify the SDM API credentials and permissions
5. Quota Limits: Check if you've hit GCP quota limits for the region

Cleanup

To destroy all resources created by this lab:

cd main
terraform destroy

Warning

This will permanently delete all resources created by Terraform, including any data stored in databases.

Contributing

Feel free to submit issues or pull requests to improve the lab environment.